In plain English
Customer due diligence (CDD) has four building blocks: identify the customer and verify their identity; identify and take reasonable steps to verify the beneficial owner; understand the purpose and intended nature of the relationship; and carry out ongoing due diligence and monitoring.
The depth of checks should match the risk. Higher-risk customers receive enhanced due diligence (EDD): more information, more senior approval and closer monitoring. Where the law allows and risk is demonstrably low, simplified measures may be applied.
Why it matters to a board
The board approves the risk appetite that decides who the institution will and will not serve, and should see evidence that high-risk relationships really are treated differently.
Common mistakes
- Applying the same checks to every customer.
- Not documenting why a customer was rated lower risk.
- Treating enhanced due diligence as more paperwork instead of more understanding.
What the standards and regulators say
- FATF Recommendations: international standards on combating money laundering and the financing of terrorism and proliferation
- UAE: Federal Decree-Law No. 10 of 2025 on anti-money laundering and combating the financing of terrorism and proliferation, and its executive regulations (Cabinet Resolution No. 134 of 2025)